Skip to content

Commit 481c00a

Browse files
tbrehmtbrehm
committed
Implemented: FS#1434 - Extend vhost config rollback to ssl certificates
1 parent a932880 commit 481c00a

File tree

1 file changed

+70
-3
lines changed

1 file changed

+70
-3
lines changed

‎server/plugins-available/apache2_plugin.inc.php‎

Lines changed: 70 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ class apache2_plugin {
3535

3636
// private variables
3737
var $action = '';
38+
var $ssl_certificate_changed = false;
3839

3940
//* This function is called during ispconfig installation to determine
4041
// if a symlink shall be created for this plugin.
@@ -113,6 +114,8 @@ function ssl($event_name,$data) {
113114
//* Create a SSL Certificate
114115
if($data['new']['ssl_action'] == 'create') {
115116

117+
$this->ssl_certificate_changed = true;
118+
116119
//* Rename files if they exist
117120
if(file_exists($key_file)) rename($key_file,$key_file.'.bak');
118121
if(file_exists($key_file2)) rename($key_file2,$key_file2.'.bak');
@@ -198,16 +201,30 @@ function ssl($event_name,$data) {
198201

199202
//* Save a SSL certificate to disk
200203
if($data["new"]["ssl_action"] == 'save') {
204+
$this->ssl_certificate_changed = true;
201205
$ssl_dir = $data["new"]["document_root"]."/ssl";
202206
$domain = ($data["new"]["ssl_domain"] != '')?$data["new"]["ssl_domain"]:$data["new"]["domain"];
207+
$key_file = $ssl_dir.'/'.$domain.'.key.org';
208+
$key_file2 = $ssl_dir.'/'.$domain.'.key';
203209
$csr_file = $ssl_dir.'/'.$domain.".csr";
204210
$crt_file = $ssl_dir.'/'.$domain.".crt";
205211
$bundle_file = $ssl_dir.'/'.$domain.".bundle";
212+
213+
//* Backup files
214+
if(file_exists($key_file)) copy($key_file,$key_file.'~');
215+
if(file_exists($key_file2)) copy($key_file2,$key_file2.'~');
216+
if(file_exists($csr_file)) copy($csr_file,$csr_file.'~');
217+
if(file_exists($crt_file)) copy($crt_file,$crt_file.'~');
218+
if(file_exists($bundle_file)) copy($bundle_file,$bundle_file.'~');
219+
220+
//* Write new ssl files
206221
if(trim($data["new"]["ssl_request"]) != '') file_put_contents($csr_file,$data["new"]["ssl_request"]);
207222
if(trim($data["new"]["ssl_cert"]) != '') file_put_contents($crt_file,$data["new"]["ssl_cert"]);
208223
if(trim($data["new"]["ssl_bundle"]) != '') file_put_contents($bundle_file,$data["new"]["ssl_bundle"]);
224+
209225
/* Update the DB of the (local) Server */
210226
$app->db->query("UPDATE web_domain SET ssl_action = '' WHERE domain = '".$data['new']['domain']."'");
227+
211228
/* Update also the master-DB of the Server-Farm */
212229
$app->dbmaster->query("UPDATE web_domain SET ssl_action = '' WHERE domain = '".$data['new']['domain']."'");
213230
$app->log('Saving SSL Cert for: '.$domain,LOGLEVEL_DEBUG);
@@ -606,6 +623,7 @@ function update($event_name,$data) {
606623
$this->_exec('chmod 751 '.escapeshellcmd($data['new']['document_root']));
607624
$this->_exec('chmod 751 '.escapeshellcmd($data['new']['document_root']).'/*');
608625
$this->_exec('chmod 710 '.escapeshellcmd($data['new']['document_root'].'/web'));
626+
$this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root'].'/ssl'));
609627

610628
// make tmp directory writable for Apache and the website users
611629
$this->_exec('chmod 777 '.escapeshellcmd($data['new']['document_root'].'/tmp'));
@@ -639,7 +657,7 @@ function update($event_name,$data) {
639657
$this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']));
640658
$this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/cgi-bin'));
641659
$this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/log'));
642-
$this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/ssl'));
660+
$this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root'].'/ssl'));
643661
$this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/tmp'));
644662
$this->_exec('chown -R '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/web'));
645663

@@ -673,7 +691,7 @@ function update($event_name,$data) {
673691
$this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/cgi-bin'));
674692
$this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root'].'/log'));
675693
$this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/tmp'));
676-
$this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/ssl'));
694+
$this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root'].'/ssl'));
677695
$this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/web'));
678696
}
679697
}
@@ -1118,6 +1136,11 @@ function update($event_name,$data) {
11181136
}
11191137

11201138
//* Add vhost for ipv4 IP with SSL
1139+
$ssl_dir = $data['new']['document_root'].'/ssl';
1140+
$domain = $data['new']['ssl_domain'];
1141+
$key_file = $ssl_dir.'/'.$domain.'.key';
1142+
$crt_file = $ssl_dir.'/'.$domain.'.crt';
1143+
11211144
if($data['new']['ssl_domain'] != '' && $data['new']['ssl'] == 'y' && @is_file($crt_file) && @is_file($key_file) && (@filesize($crt_file)>0) && (@filesize($key_file)>0)) {
11221145
if(count($rewrite_rules) > 0){
11231146
$vhosts[] = array('ip_address' => $data['new']['ip_address'], 'ssl_enabled' => 1, 'port' => '443', 'redirects' => $rewrite_rules);
@@ -1262,6 +1285,33 @@ function update($event_name,$data) {
12621285
//* There is no backup file, so we create a empty vhost file with a warning message inside
12631286
file_put_contents($vhost_file,"# Apache did not start after modifying this vhost file.\n# Please check file $vhost_file.err for syntax errors.");
12641287
}
1288+
if($this->ssl_certificate_changed === true) {
1289+
1290+
$ssl_dir = $data['new']['document_root'].'/ssl';
1291+
$domain = $data['new']['ssl_domain'];
1292+
$key_file = $ssl_dir.'/'.$domain.'.key.org';
1293+
$key_file2 = $ssl_dir.'/'.$domain.'.key';
1294+
$csr_file = $ssl_dir.'/'.$domain.'.csr';
1295+
$crt_file = $ssl_dir.'/'.$domain.'.crt';
1296+
$bundle_file = $ssl_dir.'/'.$domain.'.bundle';
1297+
1298+
//* Backup the files that might have caused the error
1299+
if(is_file($key_file)) copy($key_file,$key_file.'.err');
1300+
if(is_file($key_file2)) copy($key_file2,$key_file2.'.err');
1301+
if(is_file($csr_file)) copy($csr_file,$csr_file.'.err');
1302+
if(is_file($crt_file)) copy($crt_file,$crt_file.'.err');
1303+
if(is_file($bundle_file)) copy($bundle_file,$bundle_file.'.err');
1304+
1305+
//* Restore the ~ backup files
1306+
if(is_file($key_file.'~')) copy($key_file.'~',$key_file);
1307+
if(is_file($key_file2.'~')) copy($key_file2.'~',$key_file2);
1308+
if(is_file($crt_file.'~')) copy($crt_file.'~',$crt_file);
1309+
if(is_file($csr_file.'~')) copy($csr_file.'~',$csr_file);
1310+
if(is_file($bundle_file.'~')) copy($bundle_file.'~',$bundle_file);
1311+
1312+
$app->log('Apache did not restart after the configuration change for website '.$data['new']['domain'].' Reverting the SSL configuration. Saved non-working SSL files with .err extension.',LOGLEVEL_WARN);
1313+
}
1314+
12651315
$app->services->restartService('httpd','restart');
12661316
}
12671317
} else {
@@ -1274,9 +1324,26 @@ function update($event_name,$data) {
12741324
}
12751325
}
12761326

1327+
//* The vhost is written and apache has been restarted, so we
1328+
// can reset the ssl changed var to false and cleanup some files
1329+
$this->ssl_certificate_changed = false;
1330+
1331+
$ssl_dir = $data['new']['document_root'].'/ssl';
1332+
$domain = $data['new']['ssl_domain'];
1333+
$key_file = $ssl_dir.'/'.$domain.'.key.org';
1334+
$key_file2 = $ssl_dir.'/'.$domain.'.key';
1335+
$csr_file = $ssl_dir.'/'.$domain.'.csr';
1336+
$crt_file = $ssl_dir.'/'.$domain.'.crt';
1337+
$bundle_file = $ssl_dir.'/'.$domain.'.bundle';
1338+
1339+
if(@is_file($key_file.'~')) unlink($key_file.'~');
1340+
if(@is_file($key2_file.'~')) unlink($key2_file.'~');
1341+
if(@is_file($crt_file.'~')) unlink($crt_file.'~');
1342+
if(@is_file($csr_file.'~')) unlink($csr_file.'~');
1343+
if(@is_file($bundle_file.'~')) unlink($bundle_file.'~');
1344+
12771345
// Remove the backup copy of the config file.
12781346
if(@is_file($vhost_file.'~')) unlink($vhost_file.'~');
1279-
12801347

12811348
//* Unset action to clean it for next processed vhost.
12821349
$this->action = '';

0 commit comments

Comments
 (0)